Introduction 3.1 On August 9, 2012 our Office delivered to the Department of Finance an unqualified audit opinion on the financial statements of the Province of New Brunswick. The opinion indicates the Province's financial statements are fairly presented in accordance with Canadian public sector accounting standards. 3.2 To reach an opinion on the financial statements of the Province, we carry out audit work on the major programs and activities in departments. In addition, we audit major revenue items and a sample of expenditures chosen from departments. We also examine internal controls of significant computerized systems. 3.3 In almost every audit, there are audit findings to be discussed with management. While significant, the findings from our March 31, 2012 audit are not sufficiently large in dollar terms to affect our opinion on the financial statements. It is our practice to report these matters to senior officials of the departments concerned, and to ask for a response. Our significant findings and recommendations from the audit of the Province's financial statements with departmental responses are presented in the chapter. 3.4 It should be noted though that not all findings are included in the Report, because in some instances we do not consider them to be of sufficient importance to bring to the attention of the Legislative Assembly, or because public attention to internal control weaknesses, before they are corrected, could possibly result in loss of government assets. For further background on our audit objectives refer to Appendix 1. 3.5 We had several findings from the March 31, 2012 audit of the Province's financial statements. We review the findings identified to determine which findings from our work are significant. When considering which findings are significant we assess: * dollar magnitude of the item; * the risk the finding could result in a large loss or error in future; * the number of instances the finding has occurred; * if the finding has occurred in multiple departments; * if the finding was reported in a prior year; and * if we believe the finding is overall significant in nature. Highlights and Recurring Themes 3.6 Highlights and recurring themes of our significant findings are presented in Table 3.1. Table 3.1 Highlights and Recurring Themes Finding Finding addressed to Prior Year Finding Page Number Lack of documentation for management estimates Office of the Comptroller Yes 62 Finance Yes 71 Economic Development Yes 72 Lack of asset policy for recording of computer hardware and software Office of the Comptroller Yes 64 Lack of approval of journal entries Office of the Comptroller Yes 64 Finance No 79 Unreconciled consolidation variances Office of the Comptroller Yes 66 Health All entities captured for consolidation - Government Reporting Entity (GRE) is complete Office of the Comptroller Yes 63 IT - Segregation of Duties Office of the Comptroller Yes 73 NB Internal Services Agency Yes 73 & 95 Education and Early Childhood Development No 91 Finance Yes 80 IT - Security Office of the Chief Information Officer No 73 NB Internal Services Agency No IT - Policy NB Internal Services Agency No 73 Office of the Chief Information Officer Lack of an Audit Committee Office of the Comptroller No 68 3.7 We are concerned that a number of these findings were seen across different departments. As a result of the same issue arising in different departments we saw recurring themes emerge over the course of our work. Table 3.1 shows the departments where we noted these recurring themes. Due to the significance of the issues and/or the number of instances observed, we have chosen to highlight these recurring themes in this chapter. 3.8 We are also concerned at the trend of significant findings not being corrected by departments in advance of the next year's audit cycle. Table 3.1 shows which recurring themes represent repeat findings. We have adopted a new reporting format for this chapter to assist in highlighting repeat findings for further review and action. 3.9 In general, the responses from the departments were in agreement and they intend to address the concerns in the coming year. 3.10 While we have not noted any significant fraud, theft or error as discussed later in this chapter, the existence of the findings noted in Table 3.1 increases the risk of loss or mistake in the Province's financial statements. These items should be addressed prior to the next audit cycle. Details of Significant Findings 3.11 Our observations, recommendations and departmental responses to our full list of significant findings are presented in this section of our Report. Office of the Comptroller Accounting and Reporting Management’s Use of Estimates Observation 3.12 Canadian auditing standards require auditors to perform audit procedures on estimates and management’s process to develop and select accounting estimates. In prior year findings we reported several areas where accounting estimates were used and management did not have adequate documentation maintained for these estimates. While some improvements were made to support various estimates used, there continues to be several areas lacking supporting documentation, including allowances on accounts receivables and provisions on Economic Development loans. Recommendations 3.13 As in the prior year, we recommend enhanced documentation be developed by departments to demonstrate the process followed to calculate, evaluate and approve significant estimates. 3.14 We recommend the Office of the Comptroller standardize a process to be followed by departments when preparing estimates for allowances. Comments from Management 3.15 The Accounting Services group of the Office of the Comptroller (OoC) will continue to work with departmental financial resources to ensure the process followed to calculate, evaluate and approve significant estimates is documented. As this practice matures, we will work towards a more standardized practice. Government Reporting Entity (GRE) Observation 3.16 In prior year findings we reported the need to periodically review which entities are included in the GRE to ensure the current reporting of provincial organizations is appropriate, and to reconfirm the completeness of the entity. We are pleased to report some assessments were performed by the Office of the Comptroller. We encourage continued periodic review of these assessments and monitoring of developments or changes in relationships with significant entities, such as nursing homes, to determine the accounting treatment remains appropriate. Recommendation 3.17 We recommend the Office of the Comptroller continue to review and document the boundaries of the GRE to reconfirm all appropriate entities are captured. Comments from Management 3.18 As agreed last year, my Office will continue to include entity review and documentation as part of a cyclical work plan for Accounting Services. We performed such reviews during 2011-12 and will continue to evaluate others during 2012-13 and beyond. Service Organization Reports Observation 3.19 In prior year findings we reported there are several external service organizations used by the Province. It is important for management to determine that controls exist in organizations that process a significant volume of transactions on behalf of Central government. We noted management should request reports from service providers on the effective operation of controls (5970 reports or CSAE [Canadian Standard on Assurance Engagement] 3416 reports). We are pleased to report that following our comments several reports were received and reviewed by the Office of the Comptroller or departmental management. However, additional reports should still be received and reviewed including reports for Service New Brunswick, CIBC and Caisse Populaire. Recommendation 3.20 We recommend the Office of the Comptroller continue to request and review control reports (5970 or CSAE 3416 reports) for external service organizations. Comments from Management 3.21 My Office will continue to request and review control reports for external service organizations. Approval of Journal Entries Observation 3.22 During the course of our audit, we noted the Province does not have a policy in place regarding the preparation and authorization of journal entries, and journal entries made to accounts with a higher risk of misstatement, such as entries to record provisions, allowances and accruals. 3.23 With the upcoming Oracle upgrade to R12, it may be possible to incorporate automatic journal entry controls. Regardless of whether the controls are automated or manual, a documented policy should be put in place to advise departments of the Province’s required process surrounding the creation and approval of high dollar and high risk journal entries. Recommendation 3.24 We recommend the Office of the Comptroller document a policy on preparation and approval of journal entries. Comments from Management 3.25 While GNB has never had a policy regarding journal entry preparation and approval, the Office of the Comptroller agrees that such a policy would help reduce the risk of errors in the financial records of the province. Tangible Capital Asset (TCA) Policy Observation 3.26 As was noted in the prior year, the Province currently does not capitalize computer hardware and software as part of its TCA policy. This policy is not in compliance with Canadian public sector accounting standards (PSAS). A draft TCA policy for capitalizing computer hardware and software had been developed by the Office of the Comptroller, but the policy has not been implemented. In response to last year’s recommendation, the Office of the Comptroller indicated a recommendation would be made to the Board of Management regarding a specific change to the policy. This was not completed by year end. Recommendation 3.27 We recommend the Office of the Comptroller implement the necessary changes to the TCA policy to comply with PSAS before the next year end. Comments from Management 3.28 The Office of the Comptroller is in agreement with this recommendation. Non-Compliance with Metallic Minerals Tax Act Observation 3.29 During the course of our audit, we requested the audited unconsolidated financial statements of Xstrata Canada Corporation for the Brunswick Mine Site from the Department of Finance. The Metallic Minerals Tax Act states, in section 8(2.1)(a), that audited unconsolidated financial statements of the operator should be submitted with their annual tax return. The Department of Finance responded by confirming that Xstrata Canada Corporation is a component of Xstrata PLC (an international company) and audited financial statements are available only at that level. This indicates that the Department of Finance has not enforced the terms of the Act and has been accepting tax returns without the required accompanying audited financial statements. Recommendation 3.30 We recommend the Department of Finance review the terms of the Metallic Minerals Tax Act in conjunction with the processes in place for processing these tax returns and assess whether changes are required to the Act or the process, or both. Comments from Management 3.31 Office of the Comptroller has asked appropriate officials in the Department of Finance to follow up on your recommendation. We will continue to follow up and work with Finance. Documentation of Consolidation Process Observation 3.32 Consolidating the results of several Crown agencies into the Province’s financial statements is a complex process. In our prior year audit findings letter to the Office of the Comptroller, we noted the absence of documentation for the consolidation process and recommended the steps followed in the consolidation process be documented. Having a documented process would give consistency to the process and minimize errors. The process has not yet been documented. Recommendation 3.33 We recommend the Office of the Comptroller and the Department of Health document the consolidation process and forward a copy to our Office. Comments from Management 3.34 The Office of the Comptroller is in agreement with this recommendation and will work to prepare this documentation. Unrecorded Variance – Department of Health Observation 3.35 In our prior year audit findings letter to the Office of the Comptroller, we recommended consolidation variances resulting from Department of Health accounts be resolved before the next audit cycle. The Department of Health provided our Office with a reconciliation of the Department's accounts for consolidation purposes, however, the reconciliation contained a significant unexplained variance. Recommendation 3.36 We recommend the Department of Health and the Office of the Comptroller resolve the unexplained variance in the consolidation accounts. Comments from the Department of Health 3.37 Staff at the Department of Health, in collaboration with the Office of the Comptroller, have been examining the unexplained variance in accrued liabilities reconciliation since it was noted to us last fall. We have explained a part of it and will continue our work until it is resolved. The consolidation process has evolved over time and has become a very complex exercise that must be completed in a relatively short timeframe. The changes in process, changes in staff preparing the consolidation, and the complexity of the exercise has made this reconciliation process very difficult. We will continue to examine the history of the transactions and hopefully be able to resolve this issue in a timely fashion. Comments from the Office of the Comptroller 3.38 The Office of the Comptroller will continue to work with the Department of Health to resolve the remaining long time variance in the consolidation accounts. Facilicorp Qualification Observation 3.39 During the fiscal year ending March 31, 2012, Facilicorp acquired Contract Management Services Limited (CMSL). We noted Facilicorp received a qualified opinion on their financial statements as they did not consolidate the financial results of CMSL into their financial statements. We also noted the Department of Health did not take into consideration CMSL’s financial results during the Provincial consolidation process. 3.40 Overall, this circumstance resulted in Facilicorp's and the Province's financial statement information being understated by the amounts of CMSL's assets, liabilities, revenue and expenses. Recommendation 3.41 We recommend the Department of Health and the Office of the Comptroller ensure all organizations within the government reporting entity are consolidated into the Province’s financial statements. We further recommend external auditor opinions be reviewed by the Department of Health and the Office of the Comptroller to determine the accounting impact of any external auditor qualifications. Comments from the Department of Health 3.42 The Department of Health has always, and will continue to review the audit opinions of its consolidated entities. FacilicorpNB consulted with us on the matter of not consolidating the financial statements of CMSL. As the financial statements of CMSL are not usually completed until September, we agreed with FacilicorpNB that the additional expenses to obtain audited financial statements of CMSL in June to allow for inclusion in the financial statements of FacilicorpNB was not good value for money and not material for the Province of NB. This was a one time decision based on the mid year changes to the governance structure of CMSL. Beginning in the 2012-13 fiscal year, the financial transactions of CSML will be fully consolidated with the operations of FacilicorpNB. Comments from the Office of the Comptroller 3.43 The specific situation referenced occurred as a result of using draft financial statements for consolidation purposes. The Office of the Comptroller agrees with the recommendation and will continue to monitor the environment to identify organizations that form part of the government reporting entity. These organizations will be consolidated when appropriate and external auditor opinions will be reviewed for any qualifications. Audit Committee Observation 3.44 Canadian auditing standards require auditors to communicate to those charged with governance of an entity (e.g. audit committees or boards of directors) certain matters that may assist them in their governance roles and in overseeing management’s financial reporting and disclosure processes. Matters that require communication include but are not limited to: * significant audit adjustments and/or deficiencies in financial statement disclosures; * significant findings in internal control; * disagreements with management; * significant issues discussed, or subject to correspondence, with management; * significant difficulties encountered during the audit; and * fraud and illegal acts. 3.45 The Province of New Brunswick has no formal audit committee. Recommendation 3.46 We recommend an audit committee be established for the Province of New Brunswick. Comments from Management 3.47 The Office of the Comptroller believes that an Audit Committee is an essential part of any organization’s governance structure. We agree with this recommendation and will continue to work towards creating such a committee. Department of Finance Property Tax System Account Reconciliations Observations 3.48 During our work on the property tax system, which processes provincial revenues of $445 million, we noted a reconciliation variance which identified a net $2 million overstatement of property tax revenue. Upon further examination this item consisted of two errors: one error pertained to a $14 million reversal entry, which was not performed in the municipal payable account, and the second offsetting error pertained to a $12 million correction required to adjust a receivable balance which had been accumulating in error. 3.49 From our work, we noted the above errors occurred for a number of reasons: * Detailed review of account reconciliations was not performed. We were told property tax account reconciliations were reviewed by the supervisor and/or senior management. Given the errors encountered in our testing, however, the level of review for these accounts should be increased. Also, evidence of this review should be documented. * Detailed year-end procedures are not sufficiently documented. We recommended this in our 2007 report. Some draft year-end procedures were provided to us as part of our 2009 follow up but we have not seen finalized year-end procedures explaining the purpose of the accounts and how year-end reconciliations should be performed. * Detailed analysis of a revenue suspense account is not performed. Given the balance remaining in this account is posted to provincial revenue at year end, the Department of Finance should analyze all entries to this account. Had this analysis been performed, the necessary corrections may have been detected prior to the audit. * Property tax accounting staff at the Department of Finance appear to lack appropriate training. The accounting staff has recently changed and while some training was provided to new staff, more training on the background and history of the property tax accounts is required. * Documented procedures are lacking between key departments involved in the property tax accounting process. This factor contributed to recording the erroneous account receivable. Recommendation 3.50 We recommend the Department of Finance supervisors perform a detailed review of property tax account reconciliations in order to identify errors in the reconciliations and year end account balances. Evidence of this review should be documented. Comments from Management 3.51 The Department of Finance agrees with the recommendation and will review the current process and make necessary improvements to the reconciliation review currently in place. Recommendation 3.52 We recommend the Department of Finance perform a detailed analysis of the entries made to the municipal revenue suspense account. This will help eliminate the entries posted to the account and ultimately to provincial revenue in error. Comments from Management 3.53 The Department of Finance agrees with the recommendation and will implement a procedure for the review of the municipal revenue suspense account. Recommendation 3.54 We recommend property tax accounting staff continue to increase their understanding of the property tax accounting process and receive additional training on the preparation of year end account reconciliations to reduce the risk of errors in the year end account balances. Comments from Management 3.55 The Department of Finance agrees with the recommendation and will continue to build on the training and knowledge transfer to the property tax accounting staff. Recommendation 3.56 We recommend the Department of Finance document the reconciliation processes and share it with the Department of Environment and Local Government to help prevent misunderstandings in joint account procedures. Comments from Management 3.57 The Department of Finance agrees with the recommendation and will improve the documentation on the joint accounting procedures with the Department of Environment and Local Government. Accounting for Estimates Observations 3.58 During our year-end audit, we noted a number of observations relating to accounting estimates: * For the accounts receivable provision, we were not provided with a rationale for the percentages used regarding the estimate of uncollectable aged receivables. * We noted errors in the percentages used in the calculation of the allowance for loss account. Also the process used for calculating the allowance was not clearly documented. * We found an error in the calculation of the property tax reserve of $3.3 million. This error occurred because Finance included a group of properties in both the accounts receivable provision and the reserve provision. Recommendation 3.59 We recommend the Department clearly document the steps required and the rationale used to calculate the provision, allowance for loss, and reserve. Accounting staff should use this documentation when preparing year end estimates. We further recommend the Department document the rationale for all significant assumptions used in the calculation of estimates. Comments from Management 3.60 The Department of Finance agrees with the recommendation and will improve the documentation related to the calculations for the provision, allowance for loss and reserve accounts. 3.61 However, the Revenue and Taxation Division currently doesn’t have the resources and data to perform an exhaustive review of its current assumptions and will approach the Office of the Comptroller to jointly review these assumptions and the rationale used. Department of Economic Development Loans and Allowances Loan Provision Processes – Lack of Documentation Observation 3.62 The Department of Economic Development recognizes loans and their respective provisions as well as guaranteed loans and allowances of contingent liabilities throughout the year. The provisions recorded are based on management’s judgments and therefore include a number of estimates to determine the amount. 3.63 In order to audit provision amounts, Canadian Auditing Standards require that we evaluate how management: * identifies transactions, events and conditions which give rise to the need for an accounting estimate or a change in estimate; * made the accounting estimate, the use of any experts, a list of, and support for, any assumptions, the effectiveness/precision of the estimate by review of past estimates and the actual results achieved; and * has addressed estimation uncertainty. 3.64 In our prior year audit findings letter to the Office of the Comptroller, we had recommended this information be prepared to support estimates, however, it was not prepared for this year end audit. 3.65 In numerous instances no documentation was available to support the rationale for provision amounts. As well, no consistent documented process exists for assessing criteria to determine provisions on loans; each loan is evaluated separately using different methods. We also noted an additional general provision is recorded at an annual consistent percentage rate for loss, however, there is no documented evidence to support that the percentage chosen is reflective of recent collection and loss trends/history. Recommendation 3.66 We recommend enhanced documentation be developed by the Department of Economic Development in advance of next year’s audit to demonstrate the process followed to calculate, evaluate and review provisions on loan balances. Comments from Management 3.67 The Department will enhance documentation of loans provisions with the assistance of internal and external sources. Information Technology Findings Key Themes 3.68 The Government of New Brunswick has taken a significant step in the direction of aligning system infrastructure security under a single entity (NBISA), thereby enhancing the ability to effectively manage security. A centralized management process allows for a single set of policies, procedures and controls to be consistently implemented, as well as centralization of responsibility for management and monitoring of the infrastructure. 3.69 As noted previously in this chapter, at times we do not publicly report the details of our significant findings if we feel public reporting of such findings would increase the risk of possible loss of government assets. This is the case with a number of our significant information technology findings. Instead, the key themes of these findings and the responsible department are reported in Table 3.2 in summary format. Table 3.2 Information Technology Findings – Key Themes Theme Finding Finding addressed to IT - Segregation of Duties Application rights assignment Office of the Comptroller Network management NB Internal Services Agency Network firewall IT - Security Management of network access Office of the Chief Information Officer NB Internal Services Agency Powerful (administrator) access Password findings Encryption findings IT - Policy Password findings Office of the Chief Information Officer Network intrusion detection Outsourced third party service NB Internal Services Agency 3.70 We are not aware of any loss of government assets or errors which resulted from the findings noted in Table 3.2, however, we are concerned about the potential for future loss of assets or error as well as potential for loss of confidentiality and privacy inherent in the above noted findings if they remain uncorrected. 3.71 It should be noted this work was performed with a focus on the financial statement audit impact. Risks arising as a result of operational or confidentiality/privacy concerns are noted where observed but were not the main focus of our work. Department of Education and Early Childhood Development Payroll System (Gestion and EPAY) Gestion System Observation 3.72 Gestion is the system used for data input into the Education payroll system. It produces school district payroll data/information for teachers and other school district staff. The Gestion system is over 20 years old and is at great risk of failure. If a replacement solution is not implemented in a timely manner, the system may fail resulting in extensive delays in the payment of school district employees’ payroll. 3.73 From our work we noted the following: * Access security for the system is very weak. There is only one user account and one password for all users to access the system and the password has never been changed. This increases the risk of unauthorized system access, segregation of duties issues and inaccurate or incomplete data. * Some applications in Gestion are technically supported by a single contractor with little to no backup support personnel. This increases the risk of system failure. * Gestion operates on old hardware, some running a Windows 98 operating system. Also, up-to-date antivirus software is not supported on this old technology. This increases the risk of system failure. The Department has taken steps to protect the rest of the network from the risks introduced by the older software; however, this is a temporary solution. Recommendation 3.74 We recommend a replacement solution for the Gestion system be implemented as soon as possible. Comments from Management 3.75 EECD [Education and Early Childhood Development] is currently working with NBISA on the selection of a new payroll approach. This is part of a government wide initiative. Loss through Fraud, Default or Mistake 3.76 Section 15(2) of the Auditor General Act requires us to report to the Legislative Assembly any case where there has been a significant deficiency or loss through fraud, default, or mistake of any person. 3.77 During the course of our work we became aware of the following losses. Our work is not intended to identify all instances where losses may have occurred, so it would be inappropriate to conclude that all losses have been identified. Department of Agriculture, Aquaculture and Fisheries Missing cash $ 30,000 Department of Natural Resources Missing equipment from various regions $ 3,855 Department of Social Development Lost equipment $ 3,606 Department of Education and Early Childhood Development Missing equipment and cash in various school districts and head office $ 3,595 Department of Justice and Attorney General Missing cash $ 2,619 Department of Health Lost equipment $ 2,000 Department of Tourism, Heritage and Culture Missing equipment from various districts $ 1,873 Department of Government Services Missing cash $ 350 Department of Transportation and Infrastructure Missing equipment from various districts $ 125 3.78 Losses reported by our Office only include incidents where there is no evidence of break and enter, fire, or vandalism. 3.79 The Province reports in Volume 2 of the Public Accounts the amount of lost tangible public assets (other than inventory shortages). 3.80 In 2012, the Province reported lost tangible public assets in the amount of $49,172 compared to a loss of $29,290 reported in 2011. Summary Information for Other Findings 3.81 In addition to the significant findings noted earlier in this chapter of our audit work, there were several other findings that we brought to the attention of the responsible departments as a result of our March 31, 2012 financial statement audit of the Province of New Brunswick. 3.82 Not all findings brought to the attention of the department were, in our opinion, of significant importance to bring to the attention of the Legislative Assembly. However, we have prepared summary information of our other findings which we believe merit public reporting. 3.83 Recommendations pertaining to these other findings as well as departmental responses are presented in appendices to this chapter as indicated below. Department/Agency Audit Area Appendix Department of Finance Property Tax System 2 Service New Brunswick Property Tax System 3 Department of Economic Development Loans and Allowances 4 New Brunswick Internal Services Agency (NBISA) Payroll 5 Department of Education and Early Childhood Development Payroll System (Gestion & EPAY) 6 New Brunswick Internal Services Agency (NBISA) Accounts Payable Input and Approval (IPM) Process 7 Department of Social Development Long-term Care System (NBFamilies) and NB Housing Expenditures 8 Appendix 1 - Audit Objectives 3.84 Our examination of the matters included in this chapter of our Report was performed in accordance with Canadian generally accepted auditing standards, including such tests and other procedures as we considered necessary in the circumstances. The matters reported should not be used as a basis for drawing conclusions as to compliance or noncompliance with respect to matters not reported. 3.85 We obtain reasonable assurance on the financial statement figures because it would not be cost effective to obtain absolute assurance - our auditors cannot test every transaction. 3.86 By applying audit procedures to test the accuracy or reasonableness of the figures appearing in the financial statements, we achieve our desired level of assurance. We use audit procedures such as tracing samples of transactions to supporting documents, testing the effectiveness of certain internal controls, confirming year-end balances with third parties and reviewing the reasonableness of estimates. 3.87 Because of the limited objectives of this type of audit work, it may not identify matters which might come to light during a more extensive or special examination. However, it often reveals deficiencies or lines of enquiry which we might choose to pursue in future audit work. Responsibilities Pertaining to the Audit Process 3.88 The government is responsible for the preparation and the content of the Province’s financial statements. The Statement of Responsibility at the front of Volume 1 of Public Accounts is signed by the Minister of Finance on behalf of the government. The Comptroller is responsible for preparing the financial statements in accordance with Canadian public sector accounting standards. When preparing the financial statements, the government must make significant estimates, as not all information is available or determinable at the time of finalizing the statements. Examples of areas where management has made estimates in the financial statements are: provision for loss on loans and accounts receivable, contingencies, employee future benefits and tangible capital assets. 3.89 Our Office is responsible for auditing the financial statements. An audit provides reasonable, but not absolute, assurance that the Province’s financial statements are free of material misstatement. Material misstatement refers to an item or group of items that, if omitted or misstated, would alter the decisions of reasonably knowledgeable financial statement users. The tolerable level of error or misstatement is a matter of judgment. Appendix 2 Department of Finance Property Tax System 3.90 Approval of Journal Entries to the Property Tax System In conducting our audit work, we found journal entries were made to accounts within the property tax system. These journal entries were for significant amounts and although initial approval was received and documented, we saw no evidence the journal entries were reviewed before they were posted. Recommendation Comments from Management We recommend the Department of Finance implement a documented review process for all significant journal entries to the property tax system. The Department of Finance agrees with the recommendation and will implement a documented review/sign-off process for manual journal entries in excess of $100,000. Also, the new Property Tax System targeted for implementation in the Fall of 2014 will have functionality to set limits on financial transactions that will require supervisor or co-worker system approval before it can be posted. Appendix 2 (continued) Department of Finance Property Tax System 3.91 Change Management We noted due to a lack of segregation of duties, there is potential for unauthorized changes to be made to the property tax system. Presently, the programmer submits the change requests to a third party to put program changes into production. Best practices suggest programmers should not be authorized to put changes into production as this increases risk of unauthorized changes. Recommendation Comments from Management We recommend the Department of Finance implement control procedures so that only tested changes can be put into production. We further recommend duties be adequately segregated such that the approval to put changes into production should not be the responsibility of the programmer. The Department of Finance agrees with the recommendation and the Property Tax Renewal project is currently in place to update the current Property Tax system to a more modern platform which will provide an opportunity for a more adequate change management process. The implementation of Phase I of the new system is scheduled for September 2014. In the interim, the Business Owner will review the existing change management process and determine if temporary adjustments can be implemented to improve controls on the existing procedures. Appendix 3 Service New Brunswick Property Tax System 3.92 Verifying Assessment Data During our review of the property tax assessment process, we noted assessments are entered into the costing system by either the assessor who performs the property assessment or by administrative support personnel. We found there is no review of the property assessment values entered into the system. A review would confirm the accuracy of the data. Recommendation Comments from Management We recommend Service New Brunswick require the property assessment values be verified by a second party to ensure accuracy of the data entered into the system. The inputting of assessment data will be reviewed and documented during the road review process. 3.93 Documenting the Road Review We noted in the property assessment process there is no formal documentation of road reviews. A road review is conducted by the assessor and the office manager as a quality check on the methodology used and on the equitable level of assessments. This process occurs only after a re-inspection program has been completed. It involves a drive-by of the assessed properties and comparison of the new assessed value to prior year assessments, comparable properties and properties recently sold in the area. Anomalies identified during this process are adjusted accordingly. However, the results of this process are not documented. Recommendation Comments from Management We recommend Service New Brunswick document and file the results of its property road reviews. Service New Brunswick currently completes a road review of all property valuations completed during a re-inspection program. The data entered into the system and the assessment values of each property are reviewed by the office manager and the responsible assessor for the applicable neighbourhood. A road review report will be produced and filed to fully document the process. Appendix 4 Department of Economic Development Loans and Allowances 3.94 Current Year Loan and Guarantee Provisions - Lack of Documentation Under certain agreements, recipients of loans or loan guarantees are required to submit audited financial statements or other financial information to the Department. Current year audited financial statements, for those loans which require them, were not available for all loans tested. Of the 15 items selected for testing we were unable to review audited financial statements for three companies with loans totalling $163 million. Provisions are based primarily on undocumented discussions with both the Departmental loans officers and the respective company and therefore sufficient appropriate audit evidence was difficult to obtain to corroborate such discussions. Recommendation Comments from Management We recommend the Department of Economic Development maintain documentation regarding which financial statements or other financial information have been received for each loan receivable. Follow up should occur for items required in the loan agreement but not received by the requested date. Documentation should also be kept on file for all discussions, both internal and external, that are held to establish or support provisions. The Department will review its compliance report and will make any necessary adjustment. At the same time, the Department will also review its information requirement on financial assistance for the process of establishing provisions of loans. Appendix 4 (continued) Department of Economic Development Loans and Allowances 3.95 PHL Financial Statements Provincial Holdings Ltd. (PHL) is wholly owned by the Province and transactions related to PHL are recorded in the Province’s Oracle system by the Department of Economic Development. The Department produces stand alone financial statements for PHL that are audited by an external auditor. During our audit of loans, we selected one loan that was issued by PHL. We noted the financial statements of PHL were not yet finalized. Per discussions with Department staff, there was a delay issuing these financial statements due to their external auditor waiting to obtain sufficient appropriate audit evidence to support the fair value of assets held for sale and an environmental remediation liability. Recommendation Comments from Management We recommend the Department of Economic Development ensure all areas requiring management judgments and estimates are fully supported and documented. The Department will ensure that all areas requiring management judgments and estimates are fully supported and documented. Appendix 5 New Brunswick Internal Services Agency (NBISA) Payroll 3.96 Payroll Initiation of Bi-weekly Payroll Process During our audit, we examined the payroll initiation process. Payroll initiation is a mandatory, time sensitive step and must be completed accurately in order for the payroll to run and for employees to receive their pay. We reviewed system access and found 18 users have access to initiate the payroll including some people who are not employees of the NBISA. We found this number to be excessive and not reasonable given the significance of the payroll initiation process. While other controls mitigate this weakness, allowing too many users access to the payroll initiation screens increases the risk of fraud or error in the payroll. Recommendations Comments from Management We recommend the NBISA determine who should have access to initiate the payroll process and restrict system access to these authorized individuals. We recommend the NBISA monitor future access assignments so that only a limited number of users can perform sensitive payroll functions. Access by non-NBISA employees has been removed. As explained, initiating the payroll is done by requesting a report through the report menu. Other controls mitigate the risk of fraud or error. These controls include: * Specified and defined report criteria must be entered into HRIS [Human Resources Information System] to request this report. If improper information is entered, the system aborts and shuts down. * The report request must be faxed to production control in order to run. A process to ensure this fax gets sent over on payroll cut-off days has been implemented. * Production control has a copy of the payroll schedules and monitors to ensure that the payroll is initiated on the proper days. Appendix 5 (continued) New Brunswick Internal Services Agency (NBISA) Payroll 3.97 Hard Coding System Access – Rights and Privileges From discussions with Information System managers at the NBISA, we found the payroll system is hardcoded to provide some users with extra security rights. Hard coding is when users’ access to various system screens is granted by program coding as opposed to granted through regular group security processes. The hard coding provides an extra layer of security when combined with the system security groups. When we first inquired about this, we found the NBISA had not documented, nor was it aware of the extent of the hard coding in the system. The NBISA since has determined and documented all system hard coding. The hard coding is required because standard group security is not possible in some cases due to the age of the system. Hard coding system security increases the risk of users having access to unauthorized areas of the system, especially when employees’ job functions change. All future system hard coding should be documented and monitored. Recommendation Comments from Management We recommend if the NBISA hard codes system security in the future, the NBISA should document and monitor the hard coding so that: * it is aware of the security assigned to system users, and * it can determine the appropriateness of this security. The hard coding was done when the system was first implemented. No new hard coding was done this past year and no new hard coding is expected on a go forward basis. Appendix 5 (continued) New Brunswick Internal Services Agency (NBISA) Payroll 3.98 Supervisor Review and Approval of Bi-weekly Payroll The supervisor review and approval process is a key control in the payroll process. In addition to reviewing employee terminations, it also includes reviewing and approving batch logs, commencements, and bi-weekly reconciliations. During our work, we performed four payroll system walkthroughs. A walkthrough involves selecting a transaction and following the transaction through the entire control process from beginning to end. In our four payroll system walkthroughs, we examined four supervisor reviews of bi-weekly payrolls. One of the four examined was reviewed properly. However, we noted the following exceptions: * Two of the four payrolls examined did not have a review performed. These payrolls were for pay periods ending November 5, 2011 (casual civil service totalling approximately $423,000) and November 26, 2011 (regular civil service totalling approximately $3.1 million). * One bi-weekly payroll was approved; however, not all steps in the review process were completed by the supervisor. The supervisor did not approve the batch logs for the pay period and did not verify all required checklists were present (regular civil service totalling approximately $1.9 million). In order for the supervisor review process to be effective, the review needs to be done on a timely basis and all required steps must be completed so any payroll errors are detected and corrected promptly. Recommendation Comments from Management We recommend the NBISA supervisor reviews of all biweekly pay runs be completed on a timely basis so errors in the payroll are detected and promptly corrected. We have been working with supervisors to ensure that they are done in a timely manner. Steps have been taken to increase the number of supervisors as well as a payroll compliance officer who will be responsible for this. We are also undertaking a process review that includes examining CICA standards to identify those appropriate for adoption by NBISA. This work is being completed in conjunction with the Office of the Comptroller. Appendix 5 (continued) New Brunswick Internal Services Agency (NBISA) Payroll 3.99 Bi-Weekly Reconciliation Process Bi-weekly reconciliations are another key control in the payroll process. The payroll and benefits officer prepares the reconciliations which compare the prior period payroll to the current payroll and considers all changes to the current payroll. The bi-weekly reconciliations should be completed on a timely basis in order to detect and correct payroll errors quickly and efficiently. In our four payroll system walkthroughs, we found two of four bi-weekly reconciliations were not performed on a timely basis. Both of these reconciliations were for regular civil service payroll: • One reconciliation was prepared five months after the pay period end date. The pay period end date was June 25, 2011 and the reconciliation was completed October 19, 2011. The payroll amounted to approximately $1.9 million. • The other reconciliation was prepared three months after the pay period end date. The pay period end date was November 26, 2011 and the reconciliation was completed February 16, 2012. The payroll was approximately $3.1 million. Because of the unexpected results in our four walkthroughs, we tested thirty bi-weekly reconciliations, twenty regular payrolls and ten casual payrolls. We found eight of the twenty regular reconciliations were not reviewed by the supervisor until two months after the pay period end date. The total amount of the payrolls was approximately $2.6 million. We also found four control weaknesses in the casual reconciliations sampled. Three casual reconciliations were only reviewed by the supervisor three to five months after the pay period end date. The payrolls were approximately $132,000. One casual reconciliation still has not been reviewed and the pay period end date was January 24, 2012. This payroll was approximately $1,300. Recommendation Comments from Management We recommend the NBISA perform all bi-weekly payroll reconciliations on a timely basis so errors, if any, are detected and promptly corrected. See above response [3.97] to “Supervisor Review and Approval of Bi-weekly Payroll”. Appendix 5 (continued) New Brunswick Internal Services Agency (NBISA) Payroll 3.100 Review of Non-Routine Manual Calculations As part of the payroll process, the payroll and benefits officer (PBO) is often required to prepare manual calculations. These calculations are prepared and submitted to the payroll supervisor with the bi-weekly reconciliation. We found these manual calculations are not reviewed by supervisors, however, we understand changes in gross pay over $1,000 are verified by the Compliance and Reporting team. We believe the risk of error is high for manual calculations as often these calculations are non-routine in nature. Having a review of non-routine manual calculations would help to mitigate the risk of calculation errors. Recommendation Comments from Management We recommend the NBISA document criteria to identify non-routine manual calculations that require review. These manual calculations should be reviewed by a second person for accuracy. We agree. This is currently the responsibility of the Compliance & Reporting team. This review provides an independent recalculation of transactions for retro pay that report on the Payroll ‘discrepancy report’. Discrepancies are then followed up with the individual Payroll and Benefits Officer. Limited Criteria (dollar value of transaction) has been documented and programmed in HRI automated procedures. Any manual calculation exceeding the dollar value is identified by the system and amounts are re-calculated by the Compliance & Reporting team. NBISA will document additional criteria. Appendix 5 (continued) New Brunswick Internal Services Agency (NBISA) Payroll 3.101 Blue Cross Reconciliations Reconciliations are performed between payroll information and Blue Cross billings to verify correct amounts are paid to Blue Cross. At the time this function was transferred to the NBISA, departments were behind in completing the reconciliations. We are not certain of the number of outstanding reconciliations prior to deployment, but we were told it is significant. A decision is needed on how to proceed with these outstanding reconciliations. We noted the NBISA has worked over the past year to complete reconciliations from the time of the departments’ deployments and has made some progress in completing these reconciliations. More work is required, however, to bring the reconciliations up-to-date. Based on information provided to us by management, for the fiscal year 2012, 183 of 348 Blue Cross reconciliations were not complete. The amount associated with the outstanding reconciliations is approximately $8 million for fiscal 2012. In total since departments deployed to the NBISA (including fiscal 2012), 290 of 492 Blue Cross reconciliations are not complete. The total amount of outstanding reconciliations is approximately $13 million. Recommendations Comments from Management We recommend the NBISA reconcile Blue Cross billings with payroll information on a timely basis so correct amounts are paid to Blue Cross. We recommend the NBISA, in consultation with the Office of the Comptroller, determine how to proceed with the outstanding Blue Cross reconciliations that existed prior to departments’ deployments to the NBISA. Management accepts responsibility for those Blue Cross reconciliations which should have been done from the date of deployment onward. We recognize the importance of these reconciliations and have assigned resources to ensure this activity occurs in a timely manner. The residual issue of previous backlog has been discussed with the Office of the Comptroller and a working team comprised of NBISA, Office of the Comptroller and the Office of Human Resources has been established. Appendix 5 (continued) New Brunswick Internal Services Agency (NBISA) Payroll 3.102 Termination Process During our audit, we examined the process for terminating employees from the payroll. The payroll and benefits officer (PBO) follows a termination checklist that outlines the proper steps to follow. The checklist is signed off by the PBO, attached to supporting documents and is then forwarded to the supervisor for review. The supervisor verifies the payroll system agrees to the supporting documentation. In our four payroll system walkthroughs, we examined one regular civil service termination with a termination date in November 2011. At the time our work was performed, four months after the termination date, the supervisor had not yet reviewed the termination documents. Supervisor review of terminations is a key control in the payroll process as it helps ensure employees are terminated properly from the payroll system. It also helps ensure employees are receiving the proper pay upon termination. While we found no monetary errors in our examination of terminations, the supervisor review of terminations should be performed promptly so that any errors are detected and corrected in a timely manner. Recommendation Comments from Management We recommend the NBISA review promptly employee terminations so that errors, if any, can be corrected in a timely manner. Steps have been taken to increase the number of supervisors as well as a payroll compliance officer who will be responsible for this function. We are also reviewing the supervisor review process to ensure it is efficient to aid supervisors in completing in a timely manner. Appendix 6 Department of Education and Early Childhood Development Payroll System (Gestion and EPAY) 3.103 Program Change Management – Segregation of Duties The program change management process in place for Gestion is informal and inadequate. We noted the Department was unable to provide us with the following information: * a listing of all change requests made during the year; * detailed support for specific change requests; * approval of change requests; * testing results for change requests; and * authorization to promote changes to production. Without having documentation to support system changes the risk of unauthorized system changes and system operation errors increases. Recommendation Comments from Management Given the Gestion system will not be replaced immediately, we recommend the program change management process for Gestion be formalized and documented by the Department of Education and Early Childhood Development. Documentation should be on file to show all changes are documented, approved, tested and approved to production. EECD [Education and Early Childhood Development] will ensure documentation for system change management processes is in place for the Gestion system. Appendix 6 (continued) Department of Education and Early Childhood Development Payroll System (Gestion and EPAY) 3.104 Data Entry Verification Process School district payroll staff enter data into the Gestion system. Add or Change (AC) forms are printed from the system and sent to the data entry group (in Marysville) to enter the data into the EPAY system. During our walkthrough of the new employee commencement process, we noted a good control check where payroll staff compare the returned AC forms from Marysville with the data input into the EPAY system to ensure accuracy. However, evidence of this data entry validation process is not documented on the AC form. Recommendation Comments from Management We recommend the Department of Education and Early Childhood Development payroll staff initial the Add or Change (AC) forms to provide evidence they confirmed the accuracy of the data entered into the EPAY system. EECD will advise School Districts to confirm the accuracy of the data by initializing the AC forms. Appendix 6 (continued) Department of Education and Early Childhood Development Payroll System (Gestion and EPAY) 3.105 Leave Tracking During the year, the Province recorded a liability for sick leave. As a result, audit work was performed over the accuracy of leave tracking and sick leave data. Leave tracking for Part II employees is done through Gestion. Leave reports are sent from the schools and the data is entered into Gestion by the districts. Annually, leave history reports are printed from Gestion and placed in employee files. In some instances, the leave reported on the printouts did not agree to the data in the system, meaning data may have been entered subsequent to printing the reports. Recommendations Comments from Management We recommend the Department of Education and Early Childhood Development review the process for leave tracking, including setting a deadline for data input to provide up to date records on usage and remaining balances of leave available for use. We recommend the Department of Education and Early Childhood Development document required district processes with respect to sick leave data entry and record retention to achieve greater consistency across all districts. This is currently a manual process. School Districts will update leave tracking on a monthly basis as soon as possible using the current system. This process will form part of the new payroll system to be put in place. Appendix 7 New Brunswick Internal Services Agency (NBISA) Accounts Payable Input and Approval (IPM) Process 3.106 Partnership Agreements / Delegation of Payment Authority As at March 31, 2012 we noted the NBISA did not have signed service partnership agreements with all departments. These agreements set out roles and responsibilities for the NBISA and departments, as well as provide delegation of departmental payment authority to the NBISA. Bridging documents had been signed by some departments, assigning interim payment authority to NBISA on behalf of the signing department. It is our understanding that as at August 1, 2012 signed service partnership agreements or bridging documents are still outstanding from several departments. Recommendation Comments from Management As in the prior year, we recommend the NBISA obtain signed service partnership agreements with each department to which the NBISA provides service. Service Partnership Agreements (SPA’s) are a critical element of a shared services agency. Final SPA’s have been provided to all 15 departments and review meetings have been conducted. 3.107 Table of Spending Authority (TOSA) Confirmations As at March 31, 2012 the table of spending authority (TOSA) confirmations had not been sent to departments by the NBISA. It is our understanding, subsequent to year end, confirmations were sent to departments impacted by government restructuring and the intent was to send confirmations to the remaining departments shortly thereafter. Recommendation Comments from Management We recommend the process of confirming the TOSA with each department become part of the NBISA’s annual year end procedures. TOSA reports are prepared and sent to departments for confirmation as part of year end procedures. The 2011-2012 TOSA confirmation process took more time than usual and extended into early June due to the significant impact of Government restructuring. Appendix 7 (continued) New Brunswick Internal Services Agency (NBISA) Accounts Payable Input and Approval (IPM) Process 3.108 Segregation of Duties During our segregation of duties testing, we found one employee who had the ability to input invoices and apply payment authority, as well as add vendors to the supplier maintenance file. However, the individual who had this access did not have the ability to apply spending authority for payments and both payment and spending authority are required before a payment can be made. As this is the second year that such a finding was noted, it indicates the current segregation of duties controls continue to contain weaknesses. Recommendation Comments from Management We recommend the NBISA employees not be granted access to incompatible duties. We have determined that the instance observed stemmed from staff having roles within two separate systems (Oracle EBS and Oracle IPM) and the systems being owned by separate entities, each with their own security administration. In the instance identified, the individual did not have the ability to independently complete transactions from end to end or to cause a payment to be made. Appendix 8 Department of Social Development Long-term Care System (NBFamilies) and NB Housing Expenditures 3.109 NBFamilies – Annual case review Departmental guidelines suggest that an annual case review be conducted on clients receiving services from an adult residential facility. Regular case reviews and client contact help ensure clients continue to receive an appropriate level of care to meet their needs and to ensure the services currently being provided continue to remain necessary. In eleven items tested, we found two cases where the case reviews were not performed within the yearly timeframe. In the first case, a long term care assessment had been prepared for the client in 2003 and there was no case review documented in the system since. In the second case, the assessment had been prepared in 2008 with no case reviews since. Recommendation Comments from Management We recommend the Department of Social Development conduct client reviews on an annual basis as required by policy. The client reviews should be documented in the NBFamilies system as evidence that the reviews were completed. Such reviews will help ensure clients continue to receive an appropriate level of care to meet their needs and to ensure the services currently being provided continue to remain necessary. We concur with this recommendation. Both the Long-Term Care Services Manual (dated June 2004) and the Disability Support Program Manual (dated January 2010) specify that case reviews are to occur at minimum annually. Appendix 8 (continued) Department of Social Development Long-term Care System (NBFamilies) and NB Housing Expenditures 3.110 NBFamilies – Financial assessments There are two financial documents that must be completed to determine the amount of the client contribution: a financial declaration form and a financial contribution form. The financial declaration form is completed by the client and it records the client’s income. Using this information, the Department of Social Development completes a financial contribution form which uses a pre-determined formula to calculate the amount of the client contribution. During our testing, we found one case in ten items tested where the financial documents were not current. This may result in an incorrect client contribution amount. Recommendation Comments from Management We recommend the Department of Social Development complete financial reassessments for clients within a two year timeframe as required by policy. This procedure is important to minimize the risk of inaccurate payments. We agree with this recommendation. Again the Standard Family Contribution Procedures Manual in Section 6.1(2) outlines the conditions when a reassessment for subsidized clients should be undertaken, one of which is at least every two years for each client. Appendix 8 (continued) Department of Social Development Long-term Care System (NBFamilies) and NB Housing Expenditures 3.111 NBFamilies – Contracts with service providers The Department of Social Development signs contracts on an annual basis with service providers authorizing them to provide services to departmental clients at specified rates. The contract also sets out terms and conditions that the service providers must meet. As part of our testing, we agree service provider invoices to the rates in the approved contracts. During our testing, we found one case in four items tested where the rate paid to the service provider did not agree to the contract. We were informed there is an informal agreement with the service provider to pay this higher rate as the care needed for the client is more complex. The appropriate person approved the payment as spending authority; however, this informal agreement was not properly documented. Recommendation Comments from Management We recommend the Department of Social Development document all fee agreements with service providers. SD [The Department of Social Development] in general agrees with this recommendation. There may be exceptions where the standard specified contract/agreement fee is adjusted to adapt to a more complex situation and is not reflective of the contract rate. We would hope the individual NBFamilies service requisition rate would reflect the modified rate. Appendix 8 (continued) Department of Social Development Long-term Care System (NBFamilies) and NB Housing Expenditures 3.112 NBFamilies – Documentation As part of our testing, we determine whether the amount contributed by clients for provision of services is correct. The amount of the client contributions affects the amount the Department pays to service providers for clients’ care. During our testing, we found one case in ten items tested where there was not sufficient documentation on file to assess the appropriateness of the client contribution. Thus, we were unable to determine if the Department portion of the expense was correct. Recommendation Comments from Management We recommend the Department of Social Development financial assessors properly document financial assessments and client contribution calculations. This procedure is important to minimize the risk of inaccurate payments. We agree with this recommendation. Section 3.2 of the Standard Family Contribution Procedures Manual (dated January 2007) clearly outlines the information requirements and documents that the financial assessor must ensure are on file. In addition, Section 8.4 of the manual outlines the forms that are to be used in the client contribution calculations. 3.113 NB Housing – Documentation The Department of Social Development was unable to provide us with documentation to support the payment for one of the items tested. We were therefore unable to examine the invoice for purposes of our audit or determine the validity of the payment. Recommendation Comments from Management We recommend the Department of Social Development’s regional offices retain all invoice documentation. Documents should be filed to permit easy retrieval if required for later examination. We concur with your recommendation. Again this appears to be an isolated event as the finding pertains to one item. Appendix 8 (continued) Department of Social Development Long-term Care System (NBFamilies) and NB Housing Expenditures 3.114 NB Housing – Spending Authority In our testing, we found one case where the person who signed as spending authority approved an amount over his/her spending limit of $1,000. The payment was for $27,518 and related to subsidized housing rent. Recommendation Comments from Management We recommend the Department of Social Development require employees to follow the spending authority limits delegated by the Deputy Minister when approving payments. We agree with your recommendation. Matters Arising from our Audit of the Financial Statements of the Province Chapter 3 Chapter 3 Matters Arising from our Audit of the Financial Statements of the Province 100 Report of the Auditor General - 2012 59 Report of the Auditor General - 2012